ClawHub

Vouch

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent for Vouch identity management, but it gives an agent broad authority over keys, identity state, message handling, and deployment without enough guardrails.

Install only if you trust Vouch and the vouch.directory installer. Prefer inspecting or verifying the installer first, use a test network while evaluating, keep wallet/API/OpenAI keys out of shell history and logs, and require explicit approval before running delegation, publishing, deployment, revocation, reset, teardown, billing/account-changing, or receiver-handler workflows.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
99% confidence
Finding
The install instruction executes a remotely fetched script directly with bash, which gives the remote server full code-execution capability on the host at install time. In a skill intended for agents and automation, this is especially risky because users may run the command non-interactively and without inspecting the script first.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The agent creation flow asks the user to enter an OpenAI API key but provides no guidance on secure handling, storage, masking, or avoiding accidental inclusion in generated files. Because this skill scaffolds deployable agents, mishandling the credential could lead to secret leakage through source control, logs, shell history, or deployed artifacts.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal